Vendor Landscape

Research date: 2026-07-22.

This was the initial sandbox-oriented survey. The later decision that devcloud needs remote development hosts rather than generic sandboxes supersedes its shortlist. See Remote Development Host Vendors for the active vendor path.

The shortlist must be tested with the actual dashboard, client, and pnpm dev:editor workloads. Documentation alone cannot establish disk I/O, memory pressure, update speed, or WebSocket/auth correctness.

​

Blacksmith

Blacksmith is already contracted and is attractive for test execution, but its currently documented products do not yet establish a complete devcloud box.

• Standard runners are job-scoped and destroyed after the GitHub Actions job.
• Testboxes are early beta. They keep one runner warm, rsync local changes, run repeated commands, stream output, and default to a 30-minute idle timeout.
• Testboxes remain backed by a GitHub Actions job, so GitHub’s job lifetime and product coupling apply.
• Arbitrary authenticated HTTP/WebSocket previews, durable stop/resume, organization box RBAC, private VPC routing, and a supported provisioning API are not publicly documented for Testboxes.
• Blacksmith Sandboxes advertises full VMs, an SDK, and managed snapshots, but is still marked “coming soon” with no public limits, price, or SLA.

Primary sources:

• https://docs.blacksmith.sh/blacksmith-testbox/overview
• https://docs.blacksmith.sh/blacksmith-testbox/cli
• https://docs.blacksmith.sh/blacksmith-observability/ssh-access
• https://www.blacksmith.sh/sandboxes

Conclusion: use Testboxes now only as a possible command/test accelerator. Ask Blacksmith for Sandbox beta access and written answers before considering it the main box provider.

​

AWS

AWS is the control baseline because it can satisfy every infrastructure requirement without waiting on a vendor roadmap.

• EC2 provides full process and Docker flexibility.
• EBS preserves checkouts, package stores, build caches, and local service data independently of instance lifetime.
• Auto Scaling warm pools can keep stopped, running, or hibernated instances.
• SSM provides shell, Run Command, and port forwarding without inbound SSH.
• ALB supports HTTP and WebSocket routing, but personal dynamic component selection still needs a small routing service.
• EventBridge Scheduler and a fenced state record can implement one-hour idle shutdown.

Primary sources:

• https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-warm-pools.html
• https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-hibernate-overview.html
• https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html
• https://docs.aws.amazon.com/ebs/latest/userguide/what-is-ebs.html

Conclusion: EC2 plus EBS is the reliable fallback and likely benchmark winner for the 20 GB dashboard/client processes. The downside is building and operating the workspace product layer.

​

Coder on AWS

Coder supplies the control plane, agent, routes, SSH, RBAC, templates, autostop, and prebuilds while keeping compute and data inside Mintlify’s AWS account. It is the most mature human-development option and reduces custom platform work. Its likely production requirements, including prebuilds, richer RBAC, audit, and high availability, are paid features. The product’s generic workspace/Terraform model may also be heavier than devcloud’s three fixed components. Primary sources:

• https://coder.com/docs/admin/infrastructure/architecture
• https://coder.com/docs/user-guides/workspace-lifecycle
• https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces
• https://coder.com/docs/user-guides/workspace-access/port-forwarding

Conclusion: prototype if buying the mature control plane is preferable to building it. Compare total engineering cost, not only license price.

​

Daytona

Daytona offers the closest managed API shape and is already integrated in a Mintlify server branch. Documented strengths include managed warm pools, VM pause with memory, container filesystem persistence, snapshots/forks, process sessions, log streaming, preview URLs, SSH tokens, organization roles, VPN/BYOC options, and independent lifecycle timers. The gating questions are available CPU/RAM/disk shapes, local-disk performance for large JS dependency trees, private networking, current API behavior after the source moved private, and commercial limits. Primary sources:

• https://www.daytona.io/docs/en/sandboxes
• https://www.daytona.io/docs/en/persistence
• https://www.daytona.io/docs/en/process-code-execution
• https://www.daytona.io/docs/en/preview

Conclusion: include in the hands-on bakeoff because integration code already exists and the lifecycle API matches devcloud well.

​

Cloudflare Sandbox

Cloudflare Sandbox reached GA in April 2026 and is more relevant than older vendor comparisons suggest. It provides named persistent containers, background processes, PTYs over WebSocket, command/file APIs, filesystem watching, HTTP/WebSocket preview routing, stable named tunnels, warm pools, object-storage mounts, backups, and rolling disk snapshots. A Durable Object supplies per-sandbox coordination. Unknowns for devcloud are maximum memory and local disk, Docker-in-Docker/full VM needs, sustained Next.js and backend performance, private AWS connectivity, and whether active-CPU pricing behaves well with watchers and workers. Primary sources:

• https://developers.cloudflare.com/sandbox/
• https://developers.cloudflare.com/sandbox/api/
• https://developers.cloudflare.com/sandbox/api/ports/
• https://blog.cloudflare.com/sandbox-ga/

Conclusion: include only if published/account limits can fit a 20 GB process and the backend stack. Its routing primitives are especially strong even if compute is not selected.

​

Vercel Sandbox

Vercel Sandbox v2 now supports named persistent microVMs with automatic filesystem snapshots, resume hooks, forks, detached commands, exposed ports, network policy, and up to 32 vCPU on Enterprise. Pro/Enterprise sessions have a 24-hour running timeout, but persistent boxes can resume and restart services. Unknowns are memory/disk suitability, Docker support for the backend stack, private AWS access, WebSocket behavior across the preview proxy, command-log replay, and price during watcher-heavy use. Primary sources:

• https://vercel.com/docs/vercel-sandbox
• https://vercel.com/docs/rest-api/sandboxes/create-a-sandbox
• https://github.com/vercel/sandbox

Conclusion: include as a managed candidate if its Enterprise shape and Docker story meet the backend requirements.

​

Historical Initial Bakeoff

The first practical comparison should use:

1. AWS EC2 plus EBS as the baseline.
2. Daytona because code integration already exists.
3. Coder on AWS if a purchased control plane is acceptable.
4. Cloudflare Sandbox and Vercel Sandbox only after account-limit checks confirm they can host the actual processes.
5. Blacksmith Sandboxes if beta access is granted; otherwise test Testboxes only for ad hoc command runs.

Each candidate must run the same checkout, install, cold start, incremental update, route, WebSocket, detached test, log reconnect, idle stop, and resume scenario. A vendor is not viable merely because it can execute a command.